Sources: ~700K TikTok accounts in Turkey were hacked before its May 2023 election via a flaw TikTok knew of in 2022; TikTok noticed “unusual activity” in April
Emily Baker-White / Forbes :
Context & Ripple Effects
This report extends a documented pattern rather than opening one. In September 2022, Microsoft disclosed a high-severity TikTok Android vulnerability that could hand over accounts via a malicious link — the same year sources now say TikTok learned of the flaw behind the Turkey hacks. It also lands alongside TikTok's election-year record: the company launched a US Elections Center for the midterms while coverage catalogued its misinformation struggles across Australia, France, and Kenya.
The through-line is Emily Baker-White's sourcing at Forbes: nearly a year after this Turkey report, her reporting surfaced a zero-day DM exploit hijacking accounts of CNN and Paris Hilton, which TikTok later said it had patched. The Turkey story matters because it ties that security track record directly to an election window — the highest-stakes context a platform breach can have.
First-order effects
- Roughly 700,000 Turkish account holders were compromised before the May 2023 election, and TikTok — which noticed 'unusual activity' in April but reportedly knew of the flaw since 2022 — now faces questions about why the window between detection and disclosure stretched across an election.
- TikTok's security team inherits a second known-flaw incident on the record, after Microsoft's 2022 Android takeover bug, forcing it to defend its vulnerability-response timeline publicly.
Second-order effects
- The 2024 wave of celebrity and brand hijacks via a DM zero-day shows the cost of slow fixes compounding: high-profile victims like CNN and Sony turn account security from a user-support issue into an advertiser- and partner-trust issue for TikTok.
- Election-adjacent breaches give regulators and lawmakers in Turkey and elsewhere a concrete case study linking platform security lapses to political events, raising the stakes of any future disclosure delay.
Third-order effects
- If the pattern holds — a 2022 known flaw, a 2023 mass hack before an election, a 2024 zero-day against marquee accounts — TikTok's vulnerability handling becomes a standing input into how governments weigh platform trust during election cycles, not a series of isolated incidents.
- Platforms generally face a structural shift where election-period security failures are treated as integrity failures, pulling account-takeover response under the same scrutiny as content moderation.
The trend: TikTok's account-security failures are recurring across years and geographies, converting individual exploits into a cumulative election-integrity and platform-trust problem.